Secure web container for a secure online user environment

ABSTRACT

Disclosed herein are systems and methods that allow for secure access to websites and web-based applications and other resources available through the browser. Also described are systems and methods for invocation of a secure web container which may display data representative of a requesting party&#39;s application at a user&#39;s machine. The secure web container is invoked upon receipt of an API call from the requesting party. Thus, described in the present specification are systems and methods for constructing and destroying private, secure, browsing environments (a secure disposable web container), insulating the user and requesting parties from the threats associated with being online for the purposes of providing secure, policy-based interaction with a requesting party&#39;s online services.

CROSS-REFERENCE TO RELATED APPLICATIONS

This patent application is a continuation of U.S. patent applicationSer. No. 15/003,774 entitled “Secure web container for a secure onlineuser,” filed Jan. 21, 2016, which is a continuation of U.S. patentapplication Ser. No. 14/531,837 entitled “Secure web container for asecure online user environment,” filed Nov. 3, 2014, which is acontinuation of U.S. patent application Ser. No. 13/844,026 entitled“Secure web container for a secure online user environment,” filed Mar.15, 2013, which is a continuation-in-part of U.S. patent applicationSer. No. 13/076,421, entitled “Disposable browsers and authenticationtechniques for a secure online user environment,” filed Mar. 30, 2011,which claims priority to provisional patent application No. 61/319,250,entitled “Methods to securely authenticate and access remote web browserand downstream web applications,” filed Mar. 30, 2010, all of which areincorporated herein by reference for all purposes.

BACKGROUND

Service providers are increasingly looking to deliver sensitive aspectsof their services in a secure, seamless manner to their users orcustomers. This is because users of these services are increasinglyconducting important and sensitive business and other activities online.For example, healthcare providers, financial services providers, andother online service providers may offer online services such asproviding healthcare records, portals for banking, paying bills, orsecure communications regarding any of these items. With all of theconfidential information communicated through web browsers online,service providers and users of their services are accordingly vulnerableto theft of their identifying information through infected or otherwisecompromised web browsers and through hijacked connections and spoofeddestinations. Also, since consumers have difficulty in remembering andmanaging login credentials for the service providers they use, they setusernames and passwords that may be easy to recall and can be the sameacross all accounts, so access to one username and password pair mightprovide a thief with access to multiple of the users' accounts. Theft oflogin credentials, personal information, money, healthcare data, are allpossible results. The range of risks is growing, and current securebrowsing and authentication approaches do not satisfactorily address theneed for complete security to ensure a safe online experience.

SUMMARY

Disclosed herein are systems and methods that allow for secure access toservice providers' websites and web-based applications and otherresources available through the browser upon validation of anApplication Programming Interface (“API”) call received from such aservice provider. Also described are systems and methods for secure useand retention of requesting party and/or user policies, profiles, and/orparameters, etc. Also described are systems and methods for secure useand retention of user credentials, as well as methods for dynamicauthentication of users and security for applications allowing useraccess, such as for banking, ecommerce, or other application wheremaintaining the integrity of the service provider application as well asthe user data and user machine are important. Thus, described in thepresent specification are systems and methods for constructing anddestroying private, secure, browsing web containers, insulating the userand the service from the threats associated with being online for thepurposes of providing secure, policy-based interaction with onlineservices.

Example embodiments in which the described embodiments could be usedwould include online banking customers accessing a bank website. Whenthe customer accesses the online banking website, the banking websitecould initiate an API call to an associated application on the userclient machine, providing for the initiation of a secure web containersession in which an interface is presented that appears to the user as abrowser window, but which is actually a disposable browser window orother disposable secure browser rendering framework that is a completelygraphical-based interaction over an encrypted channel in which any dataestablished as a part of the session is maintained in a segregated andencrypted space and wherein any HTML communications actually occurbetween the interposed security service described herein and the bankingwebsite servers. Such an approach insulates the bank from the need tointeract with potentially compromised user client-based browsers andprovides for a well-controlled and highly private environment forinteraction between the bank and its customers.

By the same token, the described approach could be initiated by a healthcare provider to interact with its online customers. Thus, in ananalogous way when a customer accesses the health care provider websiteand seeks personal information or attempts to transact online commercewith the healthcare provider, the healthcare provider website couldinstantiate an API call to a user client machine to establish a secureweb container session as described herein. The description of theforegoing banking and health care provider implementations should not beconsidered to be limiting in anyway, and the implementations describedin the present application may be broadly and usefully implemented inany application where browser and transactional security are a concern.

Accordingly, although the present application is generally directed tosystems and methods in which there is provided secure access to serviceproviders' websites and web-based applications and other resourcesavailable through a secure web container upon validation of an API call,it should also be appreciated that these systems and methods are a partof an overall secure ecosystem with multiple security and authenticationfeatures. Additionally, although there are references in particularembodiments to “secure disposable browsers,” “secure web containers” and“secure web rendering frameworks,” it should be appreciated that,depending upon context, these terms may be used interchangeably to referto the presentation of web images to a user in a secure embodiment, andthe terminology is used in different contexts according to the end usethat is being described at the time.

Once a user has been authenticated through techniques described in thisapplication or through requesting party authentication or userauthorization techniques, the user's activities are carried out andprotected within the secure web container as described further below,the effect of which is to remove the user's inputs and machine frombeing directly exposed and vulnerable to the public internet and whichalso insulates the service provider web application from access bymalicious applications or users. In addition, the web content deliveredwithin the secure web container is run within a protected sandbox and istherefore dislocated and insulated from vulnerabilities that may live onthe end user's machine or elsewhere. Within this secure web container,the user and service provider are able to conduct a full spectrum ofactivities. Once a session is ended, all user-identifiable attributes,account information, service provider information, and any othercommercially sensitive information associated with the transaction canbe disposed of. At the user's option or by option of the serviceprovider, such information may be maintained in separate secure storageto be re-instantiated in a new session when a user logs in from the sameor another client machine.

The advantages of the secure service environment, a component of whichis a secure web container as described below, comprise at least thefollowing facets—security, preconfigurability, policy control, anddisposability. With regard to security, the secure web container runswithin a secure “jailed” environment within the secure serviceenvironment. The secure web container code accordingly is processedwithin the secure service environment and not on the local clientmachine. Through this approach, the service renders only images of webpages on a user's machine, while keeping the code-rendering engine atthe secure service environment, dislocated from the user and the usermachine. This process of dislocating the execution of web code from theuser display of the web page enables security scanning and malwarehandling at the secure service environment, and prevents malware fromreaching the end-user machine or the service provider web server throughoften-vulnerable local machine-resident web browsers, and provides anencrypted and image-based communication method that insulates theprivate web content from interception and possible malicious use. Theservice may be co-located with a service provider's systems or may alsobe remotely located from the service provider's systems.

With regard to the preconfigurability of the secure web container, asystem is in place to maintain key elements of the user's profile and/ora service provider's profile (with their consent/selection of thisoption) and instantiates those key elements when the user or a serviceprovider requests a new disposable container session. The new secure webcontainer session accordingly may be populated with merchant accounts,user credentials, user bookmarks/favorites, browser histories, plug-ins,extensions, and session states associated with the user's previousdisposable container session(s).

Regarding the policy control element of the secure web container, suchpolicy control provides a framework for enabling an authorized party toestablish use policies for how the secure web container is used byusers. Authorized parties can include the users themselves, parents, ITadministration personnel, the service provider, and others according todesign need. Policies can include access rules, content filtering,authentication, data handling (upload/download, print), sessiontracking, logging, monitoring, private browsing (cookie handling, IPmasking and the like), validation of downstream sites, time- orgeography-based rules, and rules governing access machines, etc.

Regarding the disposability of the secure web containers, this providesfor building from scratch, per user, per requesting party (serviceprovider), per session, aspects of a secure web container session andthen disposing of all associated data at session termination. At theoption of an authorized party or according to policy, session and otherdata can be stored in the secure environment to be accessed later.

For authentication of users, the disclosed systems and methods usedynamic authentication techniques that are adaptable according to auser's configured profile and/or a requesting party's configured profilewith the system as well as environment variables around which a user orrequesting party (or someone purporting to be the user or requestingparty) presents himself or herself or interacts with the secure serviceenvironment. In conjunction with the described secure browsingenvironment, the combination of all these features provide a synergisticcombination of techniques that ensures online security.

In an embodiment, the secure service environment is a secure webcontainer service environment. The secure web container serviceenvironment embodiment utilizes a “push” model, as opposed to a “pull”model where a user initiates the service at the user's own initiative toaccess multiple user-requested downstream websites through a secure webrendering framework that appears to the user as browser through whichthe user is able to access any number of downstream websites as if usinga browser client on the user's client machine. With further reference tothe disclosed push embodiment, however, in this implementation a websiteowner or other service provider asks the secure web container serviceenvironment to contain its content in a secure web container and deliverit to the user via the disclosed “push” model using API calls. When auser clicks on a link or accesses a webpage via his or her localbrowser, the website owner passes an API call to the secure webcontainer service environment. The secure web container serviceenvironment instantiates the browser rendering framework (that may beconfigured to appears to the user as a web browser), populates it withpage data (or empty), and pushes the display to the user. From theuser's perspective, the user sees another window or a tab, and does notgo through any other connection process.

It should be appreciated that the requesting party can invoke requestsfrom contexts other than online services or websites. It could be anyapplication or service that would call the API to deliver secure webcontent, such as a local email application, a user support or ticketingsystem, or any of a number of other applications that might invoke aneed for secure user interaction.

BRIEF DESCRIPTION OF THE DRAWINGS

Reference is now made to the following detailed description of thepreferred embodiments, taken in conjunction with the accompanyingdrawings. It is emphasized that various features may not be drawn toscale. In fact, the dimensions of various features may be arbitrarilyincreased or reduced for clarity of discussion. In addition, it isemphasized that some components be omitted in certain figures forclarity of discussion. Reference is now made to the followingdescriptions taken in conjunction with the accompanying drawings, inwhich:

FIG. 1 illustrates a system for providing a secure disposable browser toa user of a service provider, in accordance with the present disclosure;

FIG. 2 illustrates a high-level service architecture for providing asecure web container within a private user environment within the secureservice environment, in accordance with the present disclosure;

FIG. 3 illustrates a system for establishing an authenticated usersession and a secure web container session in communication with auser's local machine, in accordance with the present disclosure;

FIG. 4 illustrates a flow diagram for the authentication of a user tothe secure service environment described in FIGS. 2 and 3 and theestablishment of a secure session between them, in accordance with thepresent disclosure;

FIGS. 5A-5C provide exemplary authentication screens whereby a user canbe explicitly authenticated with the secure service environmentdescribed in FIGS. 2, 3, and 4, in accordance with the presentdisclosure;

FIG. 6 illustrates an exemplary “home page” screen a user might see wheninterfacing with the secure service environment described in FIGS. 2, 3,and 4, in accordance with the present disclosure;

FIG. 7 illustrates a user's history, login names, computer names,durations and other relevant status histories for their access to thesecure service environment described in FIGS. 2, 3, and 4, in accordancewith the present disclosure;

FIG. 8 illustrates a listing of a user's devices that the user has usedto access the secure service environment described in FIGS. 2, 3, and 4and the state of the system's “trust” with respect to those devices, inaccordance with the present disclosure;

FIG. 9 illustrates a high-level service architecture for providing asecure web container within a secure web container service environmentthrough an API call, in accordance with the present disclosure;

FIG. 10 illustrates a system for establishing a secure web containersession m communication with a user's local machine, in accordance withthe present disclosure;

FIG. 11 illustrates a flow diagram for establishing a secure webcontainer service environment described in FIGS. 9 and 10, in accordancewith the present disclosure; and

FIGS. 12A-12C illustrate exemplary secure web container serviceenvironments described in FIGS. 9, 10, and 11, in accordance with thepresent disclosure.

These exemplary figures and embodiments are to provide a written,detailed description of the inventions set forth by any claims thatissue from the present application. These exemplary figures andembodiments should not be used to limit the any claims that ultimatelyissue in a patent from the present application.

DETAILED DESCRIPTION

General Architecture of Secure Web Container Environment

FIG. 1 illustrates a system 100 for providing secure web content to auser 109 of online services 110 of a given service provider 106. Thesecure web content may be pushed to the user's device 108 at thediscretion and determination of the service provider 106.

The user 109 has a device 108 for viewing online services 110. Thedevice 108 is in communication with the service provider's environment106 via connection 114 and with a secure web container serviceenvironment 104 via connection 120 over the internet, cloud, or remotenetwork 102. Further, the secure web container service environment 104is in communication with the service provider environment 106. In anembodiment, the secure web container service environment 104 is locatedremotely from the service provider environment 106 and is incommunication with the service provider environment 106 via connection116 over the internet, cloud, or remote network. In another embodiment,the service provider environment 106 and secure web container serviceenvironment 104 are co-located and are connected via connection 118 overa secure, local network.

When the user 109 accesses the services of the service provider, theservice provider may provide online services 110 to the user's device108. When the user 109 navigates to some secure functionality or contentof the online services 110 provided by the service provider 106, or atany point at which the service provider 106 determines to provide somesecure functionality or content to the user 109, the service providerenvironment is prompted by the service provider environment 106 toinvoke a secure web container 112 to display the secure functionality orcontent to the user 109. To invoke the secure web container 112, theservice provider environment 106 sends an API call to the secure webcontainer service environment 104 via connection 116 or connection 118.The secure web container service environment 104 then provides a secureweb container 112 and displays images representative of serviceprovider's application web content at the user device 108 based on theAPI call. These embodiments are discussed in further detail in relationto FIGS. 9-12C. General principles and functionality is also discussedbelow in relation to FIGS. 2-8.

FIG. 2 is a high-level diagram generally describing the user interactionand back-end operations of a secure service environment 200. Afterauthentication, which is described further below, a secure web container226 is constructed within the secure service environment 200, which isoperated securely and remotely from the end user's (potentiallycompromised) local machine 202. The secure web container 226 is further“disposable” because it is constructed at the initiation of a browsingsession and destroyed at the end of a session (along with any session orother data that the user does not wish to persist).

As discussed further in relation to FIGS. 9-12C, an embodiment of thesecure service environment 200 may be a secure web container serviceenvironment set up through an API call as illustrated therein. Usercredentials and other personal information are stored and accessedentirely within the secure service environment 200 and are never sharedwith the user's local machine 202. Through this approach, all web codeis delivered to and executed within the secure web container 226, itselfwithin a private user area or secure jail 214 operating on anauthenticated service machine 220 within the secure service environment200.

The disclosed architecture for the service is capable of supporting theAPI model as well as a number of generalized secure web containerservice environments. The API/push model as specifically describedherein in relation to FIGS. 9-12C is a particular application of thesecure web container 226. Although the present patent application isdirected to the API/push model as described herein, the enablingtechnologies described herein are intended to be additional embodimentsin either or any such embodiments according to design requirements.

Enabling Technologies for Authentication and Secure Web Container

As previously mentioned, the present application is generally directedto systems and methods in which there is provided secure access toservice providers' websites and web-based applications and otherresources available through a secure web container upon validation of anAPI call. It should also be appreciated, however, that these systems andmethods are a part of an overall secure ecosystem with multiple securityand authentication features. Before later describing the more specificelements of the systems and methods for providing secure web containersas a part of an API call as particularly described in FIGS. 9-12C,features of the secure ecosystem that may enable or otherwise be used inconjunction with any of these embodiments are described immediatelybelow.

As a part of the overall disposable browsing system, the web codereceived by the secure disposable browser 226 within the secure serviceenvironment 200 is translated using a network and application protocoland delivered (via a data translation server 206) to the end user'slocal machine 202 as encrypted display data over a secure access channel204. The thin client process 202 b on the end user's local machine 202decrypts and renders this data to the user as an image or rendering ofthe browser running within the secure service environment 200.

Operating through this system, user-generated inputs (keystrokes, mouseinput, etc.) are transmitted back to the data translation server 206 viathe same network and application protocol (as described above) over thesecure access channel 204 and accordingly to the secure disposablebrowser 226, which then passes those inputs back to the original endservice provider's website 253. The secure disposable browser 226 isbuilt per user on-demand, and it is therefore free of malware atinitiation. Upon session completion, the secure disposable browser 226and all transient session data may be purged, protecting both userclient machine and the service provider's application environment.

Still referring to FIG. 2, to maintain the security of a user's accessto his or her personal data and web applications through the secureservice environment 200, as well as to protect the service provider'sservice environment from malicious access, the user is firstauthenticated. Various embodiments of that authentication process willnow be described. The user may access the secure service environment 200initially through a standard local browser 202 a running on the user'slocal machine 202, via an encrypted HTTPS connection, connecting to aweb authentication server 205. The web authentication server 205operates code comprising computer instructions stored on acomputer-readable medium 207. The computer instructions compriseinstructions for conducting a transparent authentication process, whichwhen operational comprises process 208.

The transparent authentication process 208, which will be described ingreater detail below, uses various clues to set the confidence intervalaround the user access attempt. Generally speaking, variousenvironmental parameters regarding the user's access attempt are deemedto be either consistent or inconsistent with expected parameters forthat user. Access using a user's known or trusted local machine, duringa usual time, from a typical geographical location and with consistenthardware and software parameters etc., will yield a higher level ofconfidence around the authenticity of the user's access attempt.

Once the transparent authentication process 208 is completed, the useris provided with a secure web container such as secure disposablebrowser 226 within a secure user environment (or secure jail 214) by anauthenticated service machine 220 within the secure service environment200. The interactive authentication process 210 can now be run withcomputer instructions stored in the computer-readable medium, secureuser data store 212. The interactive authentication process 210 employsuser-customized and/or defined processes, which may also be stored, inpart, in the secure user data store 212. Upon a successfulauthentication, the user is provided with authenticated access to thesecure disposable browser 226. Each user is given their own securedisposable browser 226 within a secure jail 214 such that each user'spersonal information and disposable browser application is insulatedfrom each other user's, and the jail is also a part of acomputer-readable medium 215 contained within the authenticated servicemachine 220 for storing multiple such user environments or secure jails214 in a secure and isolated fashion. Once successfully completing theauthentication processes 208, 210, the user through their local machine202 is connected to the secure disposable browser 226 or other secureweb container operating within a secure jail 214 running in theauthenticated service machine 220, which similarly operates computercode stored with computer-readable instructions stored on acomputer-readable medium 222.

One set of instructions operated by the authenticated service machine220 establishes a secure disposable browser 226 within a per user securejail 214 in the secure service environment 200. The secure disposablebrowser 226 instruction codes are also stored in computer-readablemedium 222 or on another computer-readable medium. Although the securedisposable browser or other secure web container 226 appears as a windowdisplay on the end user's local machine 202, it is actually operatingwithin a secure jail 214 on an authenticated service machine 220 withinthe secure service environment 200. Accordingly, the secure disposablebrowser 226 insulates the end user from the vulnerabilities that areassociated with user's local machine-resident browsers which aredirectly exposed to web code on the internet. Coupled with theadvantageous authentication techniques described herein, the secureservice environment 200 provides greatly enhanced security relative toknown solutions, and once a user is operating within the secure serviceenvironment 200, he or she is able to securely perform any of a numberof additional tasks securely, and the service is able to providecoordination of the users' access to multiple secure websites, includinge-commerce, banking or healthcare websites or conduct any other onlineactivities deemed sensitive.

To provide secure storage and access to user account information anduser data, a secure user data store 212 communicates securely over anencrypted network with the authenticated service machine 220. The securedata store 212 contains user-specific information that supports thefunctionality within the secure disposable browser 226. This includesdata to authenticate and access the secure service environment 200, topotentially customize the secure disposable browser 226 with userspecific preferences (including accounts, favorites, bookmarks, history,etc.) as well as to support other applications within the securedisposable browser 226, such as a secure mail portal 240, a documentlockbox 242, and a reports and settings configuration application 244,all of which are applications executable by the authenticated servicemachine 220 when retrieved from an associated computer-readable medium,such as computer-readable medium 222. Further, the secure serviceenvironment allows for fetching of the credentials from thecomputer-readable medium 222 to allow for the user to login to variousitems such as their email, lockboxes, or other account aspects. Thesecure service environment then further provides a secure disposablebrowser 226 such that on the user's local machine 202, they would seetheir service web interface presented to them on a tabbed window.

Regarding the secure email portal 240, the disclosed system and methodprovides the ability to replace the user's email address on record withdownstream service providers with an obscured and non-identifiable (yetuser- and vendor-unique) email address controlled by the secure serviceenvironment 200. This results in emails from a service provider arrivingat this secure, hosted email portal 240. The disclosed system and methodthereby ensures the validity and authenticity of the email messages fromeach provider. The analysis of the validity and authenticity of emailmessages can include analysis of the sending server from where themessage originated (domain to IP matching) as well as examining theintegrity of message metadata to ensure authenticity. Users can then usethe email portal 240 to manage their sensitive email communications withthese chosen downstream websites 253. The secure email portal allows fordifferent logical displays, including chronological or by serviceprovider. The users can be informed of new messages in their secureportal inbox by sending notification emails to their personal emailaccount, via an icon on their local machine 202, or via SMS to theirmobile phone or other method.

Regarding the document lockbox 242, the disclosed system and methodprovides for interaction with the print/download functionality withinweb applications to offer the user convenient one-click view, print,save and search-enabled access functionality within the secure serviceenvironment. A user is accordingly able to view a document within a webapplication, “print to” PDF or similar transportable format and launch aviewer to physically print, or save to the document lockbox memory,which is a hosted and encrypted archive for statements/documents withinthe secure service environment 200 that the user can access and retrieveat times of their choosing. Users can annotate or add commentary to anydocument and have a logical view of their statements/documents by periodor service provider. The service can also enable ingestion of otherscanned documents into this lockbox via an upload mechanism from theuser's machine or other local data store. Users may also be able toshare documents with other users that are registered with the service.In this instance, a user may provide access and/or edit privileges toanother user, enabling saved documents to be shared with a user ormultiple user, without those documents being publically available orstored locally on any end user machine.

Still referring to FIG. 2, another disclosed embodiment in the presentdisclosure relates to providing usage policies per a policy database 262and admin policy portal 260. These usage policies can be set by systemadministrators on behalf of one or multiple employees, by parents onbehalf of one or more children, or otherwise by a one person on behalfof a group of people. Some or all of such policies can also be enabledand individually maintained by the users themselves according to theirdesired settings. Policies can be enforced globally for all actionstaken from the disposable browser, or on a per account basis to givemore fine-grained control over usage for particular online accounts.E.g., “log me out of all accounts after 5 minutes of inactivity”, “forceout-of-band authentication whenever I access www.mybank.com”, “onlyallow access to www.mybank.com when I'm coming from my home IP”.Particularly as the secure service environment 200 may be employed in acentralized, cloud-based environment, the setting of usage policies onbehalf of multiple users by an administrator is easily facilitated,including the setting of usage policies, e.g., on a per-site basis oraccording to other defined user groups. These usage settings can beestablished by an admin or parent or other party with admin rightsthrough the admin policy portal 260 communicating with the policydatabase 262. In the event that a user is configuring his or her ownpolicies, this admin policy portal 260 can be accessed from within theirsecure disposable browser 226 connecting to the secure serviceenvironment 200 and in turn to the admin policy portal 260 over thesecure access channel 204.

Illustrated in FIG. 3 is another, functional-level view of the secureservice environment 200 of FIG. 2. This figure illustrates theinteraction between some of the system elements described in FIG. 2.While there are certain elements shown in FIG. 2 that are notillustrated in FIG. 3 and vice versa, one of ordinary skill in the artwould be able to advantageously describe with respect to one figure inorder to achieve the advantages described herein for operation with theembodiments shown in other figures. All such embodiments are understoodby one of ordinary skill in the art to be encompassed within the presentspecification.

Within the secure service environment 200 is a web authentication server205 that provides for a user to connect to the secure serviceenvironment 200 for the purposes of initiating a log-in process, userand machine identification purposes, user-factor checking,browser-factor checking, machine-factor checking, and session-factorchecking. For storing the various factors, a master list of profile datais stored in a user database 317, which is a component of the secureuser data store 212. The web authentication server 205 is incommunication with various sub components of the secure user data store212. The user login attempt can made through the user's local machine202, typically via the user's local browser 202 a. When receiving alogin attempt, the web authentication server 205 will reference the userdatabase 317 and the session database 320 to cross-check data gatheredduring the login process, including authentication factors, from thelogin session against that stored in the database.

In the described approaches, at least some of the particular factors canbe gathered from characteristics of the user's local machine 202, aswill be further described below. As illustrated in FIG. 3, this systemdiagram provides another, consistent system view of the systemillustrated in FIG. 2. As illustrated in FIG. 3, the web authenticationserver 205 is primarily responsible for responding to and handlingrequests to initiate the login process and brokering the transparentauthentication process 208, whereas authenticated service machine 220 isprimarily responsible for accepting the incoming connection request,performing the interactive authentication process 210, and managing theper-user jailed environment which contains the secure disposable browseror other secure web container 226 (see FIG. 2). As described above, thissecure disposable browser 226 does not store user data on the user'slocal machine 202, so in conjunction with the described authenticationtechniques this method and system provides a high level of security foruser credential data and other user data.

As a part of the above-described authentication process, when a userlogs in to the secure service environment 200, the web authenticationserver 205 executes the login request against a hierarchy ofauthentication techniques, referencing the user factors previouslystored in the user database 317, which is part of the secure user datastore 212, with the aim of confirming the user's true identity (ordetecting an imposter).

Initially, the web authentication server 205 examines factors associatedwith the user's login attempt using techniques that are transparent tothe user. This enables the secure service environment 200 to place apreliminary “confidence interval” around user identity, where“confidence interval” refers to a certain degree of confidence that theuser is who he or she purports to be and the extent to which the user'slocal machine 202 is recognized as being associated with the user'saccount, or possibly modified since previous login attempts. Dependingupon this initial level of confidence, the web authentication server 205can determine whether and what further transparent and/ornon-transparent information is required from the user or the user'slocal machine 202.

Types of transparent information that can be garnered from a user'slogin attempt, such as through the session information gathered from theconnection to the user's local machine 202, include browser factors,machine factors, and session factors, as further described below.

Browser Factors. Browser-related parameters that allow identification ofuser's local browser 202 a, resident on the user's local machine 202from which the login process is being initiated. Examples of suchbrowser factors include: browser plug-in details, user agent, systemfonts, cookies, super cookies, color depth, screen size and more. Manyother factors associated with a particular browser revision orconfiguration can be detected, analyzed, and cross-checked against theuser database 317.

Machine Factors. Specific attributes of the user's local machine 202 canbe identified including by placing a unique digital certificate on theuser's local machine 202. Particular aspects intrinsic to the user'slocal machine 202 can also be detected, including software and hardwarecomponents and serial numbers (e.g., MAC address, OS fingerprint, clientapplication serial numbers, etc.). These various aspects can be detecteddirectly or they can be built into an encrypted hash derived from acombination of these various factors. This information can be previouslystored and then compared for authentication purposes against informationwithin the user database 317.

Session Factors. A collection of session-related parameters can bedetected and further used to identify and corroborate the user'sidentity. For example, IP address data can be used to determine theuser's geographic location, and this location can be checked againstexpected user location according to static and/or dynamic information(user home bases, user travel patterns, possible travel patterns, etc.)stored in the user database 317 and associated with the user.

In addition to the above-described factor analysis, the secure serviceenvironment 200 can establish behavioral norms for the user, and istherefore further capable of checking for behavioral abnormalities as apart of the identification and authentication process. Indicators caninclude a user's typical login location, typical access device, time ofday, or even a typical behavior pattern regarding activities ondownstream sites, etc. Other available indicators incorporate logicalassumptions that can be inferred from looking at recent activities suchas change in login frequency, logging in from a different location overa short period of time, cross-checking the location of a user's computeragainst that of the user's mobile phone, and more.

Further beyond the browser/machine/session factors and the detectedbehavioral norms, the secure service environment 200 allows users (oradmins on behalf of multiple users) to establish their own prescribedbehavioral rules that can be reflected within the authenticationframework, e.g., “I never log in from a public machine,” “I rarelytravel,” “I'm a road warrior,” “these are the only locations that Imight log in from,” “I'll never log in from abroad,” “I'll never log induring these hours.” Behavioral norms may be defined and applied asglobal policies, or can be defined and applied on a per-downstreamwebsite basis, establishing a policy specific to a particular websiteaccount or destination site, e.g., “only allow my home machine toconnect to this bank account,” etc. These policies are set in the policydatabase 262 described in FIG. 2 and in accordance with the portals andmethods described in the description of this aspect of FIG. 2. Theresulting identification and authentication techniques result in adynamic process in which authentication may vary time over time, basedon the composite result of service rules, deviation from user behavioralnorms and user customized policies.

If transparent authentication can not be accomplished or if one or moreof the behavioral norms is violated, or as a condition of policy furthervalidation of the user is required, additional steps can be presented tothe user. An example of when and how these steps might occur is when aknown user on an unknown user machine 202 is presented to the secureservice environment 200. In this case the secure service environment 200will lack the historical information to authenticate/identify the user.In this event, other methods can be used depending on the circumstances.In the event that the user is known, via factors supplied to the webauthentication service 205, but the user's machine 202 is unknown or notconsidered “trusted”, where trusted refers to a previous configurationsetting performed either by the secure service environment 200 or theuser themselves instructing the secure service environment 200 to trustthis machine, thereby enabling login using standard authenticationmethods without additional validation due to hardware or configurationchanges, the secure service environment 200 can use out-of-bandcommunications 332 to validate the user. Such out-of-band communicationtechniques include sending a text message to the user's registeredmobile phone. The text message would deliver a randomly generated codefor the user to enter into the web authentication server 205 via theirlocal browser 202 a to “validate” himself or herself. Anotherout-of-band approach 332 would be to place a phone call to a phonenumber registered by the user, and then similarly provide a randomlygenerated code for the user to enter into the web authentication server205 via the local browser 202 a. A third out-of-band technique 332 wouldbe to use a smart phone application or “app.” The smart phone app willbe something the user can use to log in, register with the secureservice environment 200, and/or validate himself or herself. As withregular client PCs, smart phones have hardware and/or firmware and/orlocation identifiers that specifically identify the equipment (phone),and those identifiers can be initially or further stored in the userdatabase 317 for the purpose of user identification.

If most factors are correct but a few are not, the user could still beidentified as “correct” if enough factors are found to establish a“confidence interval” around the attempted access. By using such a“confidence interval,” the authentication process is flexible anddynamic. Thus, updated hardware that is associated with an authenticateduser access could be updated into the user database 317. Thus, thesecure service environment 200 can keep a collection of profiles foreach user, such as a profile of the machine they accessed the servicefrom, a profile of the browser they accessed from, which machines thosebrowsers were associated with when they connected, what location theyare connecting from, if their mobile phone location is consistent withtheir machine location, how many times they have failed authenticationin this session prior to success, etc. The secure service environment200 can accordingly maintain a history of these items and furtheranalyze historical changes.

The historical changes tracked by the secure service environment 200 canbe used to set an expected range of the types and frequency of changesassociated with and expected from a given user. Thus, the probabilitythat a given change is correctly associated with a given user can bedetermined relative to that user's historical norms and thereby can beused to help determine the confidence interval around a user'sauthentication session. Further, the tracking of such changes and theflexible departure from a rigid authentication scheme allows thepresently described system to track changes and to accordingly allow theassociated systems to change and for the adaptable authentication systemto evolve with such change. If significant changes occur, the secureservice environment 200 may allow the change without a separatenon-transparent authentication step, but in either case, once the useris authenticated, the secure service environment 200 operates to updatecomponents of the secure user data store 212 to reflect the change.

There is a separate but related process for continuing to apply strongauthentication to the user. The above description relates to the processof authentication as could be implemented to facilitate login to thesecure service environment 200. But even if a malicious user shouldmanage to get past a first level of authentication, such as by gainingaccess to an actual user's machine and knowing sufficient identificationinformation for that user, certain behavior patterns may trigger anadditional verification step. For example, if the system recognizes thata user typically accesses their online financial service account after 5pm on weekdays, typically to review balances and to pay selected bills,but the secure service environment 200 recognizes activity that isanomalous to this typical behavior pattern, such as a large wiretransfer, the secure service environment 200 could interrupt thattransaction and prompt the user for an additional verification step.

Once the user has successfully completed the initial transparentauthentication process 208, and in the event of an out-of-band 332additional validation step that has been successfully completed, a moreformal interactive user authentication 210 process is initiated. Thisinteractive user authentication process 210 is performed within thesecure confines of the secure disposable browser, 226, and is designedto provide the user the capability to authenticate themselves, byinputting their specific authentication string into the promptsprovided. The process for starting the local environment that will beused to interact with the secure disposable browser 226, called the“thin client process 202 b”, and the act of ensuring that the datahandoff from the user's local browser 202 a to the thin client process202 b is secure, correct and complete, are described below. Aftersuccessful completion of the transparent authentication process 208, thethin client process 202 b that provides a secure connection to thesecure service environment 200 is launched on the user's local machine202. The software code operating as the thin client process 202 b oranother application running on the user's local machine including a Javaapplet or other operational code can initiate the thin client process202 b and determine if the client software is up-to-date, if componentshave been removed or altered, or if the client application has beencompromised, or if there is anything else that needs to be installed orreplaced. Next, the thin client process 202 b or another applicationrunning on the user's local machine can create an authenticated sessionfile 350 on the user user's local machine 202. In parallel, within thesecure service environment 200, and within the session database 320, theuser's session has been profiled, and a set of instructions onconnecting from the thin client process 202 b to the secure serviceenvironment 200, has been defined. This data is passed securely to theuser's local machine and constitutes the bulk of the contents of thesession file 350. This session file 350 contains data instructing thethin client process 202 b on which authenticated service machine 220 toconnect to in order to access their secure disposable browser.Connection information on where to connect may include which serviceinfrastructure to connect to in which region, which machine ID will beacting as the authenticated service machine 220, which session ID topresent in order to connect to the appropriate session process, whichsupplemental authentication factors to present, and more.

The session database 320 is referenced by the authenticated servicemachine 220. The authenticated service machine 220 acts as the systemwhich will instantiate the secure disposable browser 226 for user withina secure jail 214. The thin client process 202 b connects to theauthenticated service machine 220, and the secure service environment200 can, through this connection, present interactive authentication 210for the user, displayed via the thin client process 202 b but staged andcomputed within the secure disposable browser or other secure webcontainer 226 within the service environment 200. The connectionestablished from the thin client process 202 b to the secure serviceenvironment 200 is an encrypted secure connection. The secure connectioncan be through a secure socket layer (SSL) connection or other securecommunications protocol, and the thin client process 202 b can provideclient certifications, although the client certification process can betransparent to the user because it can be installed as a part of thesoftware delivered in order to initiate the thin client process 202 b.Through this secure communication channel, there are several layers ofcommunication/handshaking. The basic “hello” handshake is the firstlevel, followed by a security level handshake. The secure serviceenvironment 200 can further do a security check of the thin clientprocess 202 b, or the thin client process 202 b itself can run aself-certification on its own initiative or at the direction of thesecure service environment 200. In fact, although the thin clientprocess 202 b is described at times herein as being separate from thesecure service environment 200, it can alternatively be thought of as apart of the secure service environment 200, since it is a system elementdistributed as a part of the overall secure service environment 200.With this model, as well as with the additional abstractions layered into each authentication module, as described below, the act of logging onto the service is significantly more secure than alternate systems.

In establishing the connection between the thin client process 202 b andthe secure disposable browser 226, the authenticated service machine 220may access the session database 320 to ensure that a valid sessionrequest is being made. Once the validity of the session request isestablished, the authenticated service machine 220 will query the thinclient process 202 b for additional authentication factors. Once thevalidity of the additional factors is established, the authenticatedservice machine 220 will connect to the user database 317 and collectcertain user profile information as pre-configuration data for settingup the secure web container or secure disposable browser 226. Once theconfiguration information is collected, a secure jail 214 or secureprivate working environment is established within an authenticatedservice machine 220. That secure jail 214 is instantiated individuallyfor each session and can be terminated (and all associated data deleted)when its associated session is ended. These secure jails 214 provide amechanism by which a new disposable browser 226 can be created for eachuser session and populated with the users' configuration data, andwhereby such disposable browser 226 can operate on the authenticatedservice machine 220, secure from the vulnerabilities of typical usermachine-resident web browsers.

As a part of the system configuration, the authenticated service machine220 establishes a queue of pre-built secure jails 214 that are fresh.When assigning these jails 214, such information is established in thejails and the jails are ready to be populated by the secure disposablebrowser 226, complete with user-specific or other session-specificinformation such as what authorization schemes the user has, whatbackend service providers are relevant to the user, assigning relevantdata to user authentication schemes, etc. On a given authenticatedservice machine 220, there can be many secure jails 214 each with asecure disposable browser or other secure web container 226 per physicalmachine. As with multiple of the described machines in thisspecification, including the web authentication server 205 and theauthenticated service machine 220, these machines can be implemented ina virtual computing environment (“cloud computing”), such as oneprovided by using Amazon's Elastic Cloud (“EC2”) computing environment.Thus, rather than having a user-to-virtual-machine linkage, thisdescribed embodiment comprises a user-to-jail linkage, with multiplejails being assignable to each authenticated service machine 220.Further, a variety of virtual computing environments may be available invarious geographic locations, across differing vendors, and theauthenticated session file 350 that is delivered to the thin clientprocess 202 b may have specific instructions that allow the thin clientprocess 202 b to connect to an optimized authenticated service machine220, that is best suited for the conditions of the user's particularsession, e.g., on that is the nearest proximity to the user, onspecified network infrastructure, configured with the appropriateuser-specific resources, etc.

Security is provided in the secure jail 214 by establishing a securechroot environment, or similar type of system access control, in which auser's secure disposable browser 226 is restricted to a certaindirectory within the overall file system on the authenticated servicemachine 220. For each session, a new session ID is established for theuser and is used as the identifier to establish the secure jaildirectory structure. The secure jail 214, associated directory and data,and secure disposable browser is disposed of after the session iscomplete. Thus, each user will only see a set of data that is germane tothem and has been established for their current authenticated sessions.The authenticated service machine 220 has a queue of such pre-configuredsecure jails 214 available, and is accordingly able to assign them tousers upon each session request to establish a session-specific securejail 214, and can then create the secure disposable browser 226 withinthe secure jail 214 and add the user's preferences to it.

To ensure the segregation and security of the data in these jails,permissions are established as described above such that one user's datais not accessible to another user and that one disposable browser orother secure web container 226 cannot be compromised and be used tointercept or corrupt another user's disposable browser or other secureweb container 226 operating in another secure jail 214 running on thesame authenticated service machine 220. Further, the implementation caninclude independent encryption of each user's data.

To provide the element of “disposability,” these secure jails aredeleted at the end of each user session, and thus the ending of a securedisposable browser 226 session also results in the clearing of user dataand applications associated with that browser session. Thus, althoughthe secure user data store 212 may retain the user session settings, nosuch settings are stored on the user's local machine 202. Further, sincethe user is interacting with the secure disposable browser 226 using thethin client process 202 b through a secure access channel 204, using aprotocol that is restricted to display and user input data, thedownstream websites 253 that the user is interacting with are notreadily able to track user actions and user behavior. The user iscontrolling the secure disposable browser 226 remotely, and any cookiedata, source IP data or other user identifiable factors, outside of anylogin credentials that may have been supplied as part of the access tothe site, is obscured to the downstream website. Given that all cookiedata may be destroyed at the termination of the session, and given thatthe user may reconnect to another secure disposable browser that wouldhave a different source IP address, the downstream websites will only beable to track single-session behavior from a non-attributable source IPaddress. Accordingly, from a security standpoint and from a user privacyand data-tracking standpoint, the implementation of a disposable browsershields users from undesired consequences. According to policies storedin the policy database 262 (see FIG. 2), various aspects of the userbrowser session can be stored and retained, even including the specificbrowser session states if desired, but they are safely encrypted andstored within the secure user data store 212.

Certain session information can be stored in the session database 320and the user database 317 allowing the user to maintain session status,even when disconnecting and reconnecting at a later time. Depending onconfiguration and applicable polices as defined in the policy database262, a user could disconnect the thin client process 202 b from theauthenticated service machine 220, but the associated jail 214 anddisposable browser 226 could remain in situ. A user couldre-authenticate and present the original session ID or other identifier,and start the thin client process 202 b again from the same machine, orfrom another local user machine 202 or alternate type of device, such asa smart phone or a tablet computer (not shown) and re-connect to thesame authenticated service machine 220, secure jail 214 and disposablebrowser 226. This would provide continuity to the user, allowing them tomove from machine to machine, without having to re-connect to anydownstream sites when reconnecting to a secure disposable browser 226.

The program flow of the user interaction and authentication process isillustrated in FIG. 4. After transparent authentication factors arecollected and validated, the authentication process transitions from aninitial process conduced via HTTPS to a more formal process, where anauthentication application (the interactive authentication process 210)is presented to the user within the secure disposable browser 226. Theinitiation of the formal authentication process begins with the launchof the thin client process 202 b, and is illustrated in the figure inwhich the user's local browser 202 a sends account data, such as a usernickname 415, in which a look-up of the account information is performedagainst user database 317. In response to the look-up, a User ID isreturned, and a Session ID is created and associated with the User ID ataction 440. In particular at action 440, the User ID is sent to thesession database 320, where the session database performs checks, andreturns a Session ID. Then, having assigned a Session ID in the sessiondatabase 320 and associated that Session ID with the User ID, thesession connecting the secure service environment 200 can be launched,and rendered by the thin client process 202 b. This transition from aninitial connection and query via HTTPS by the web authentication server205 for performing transparent authentication 208, to remote display ofthe secure disposable browser 226 via the thin client process 202 b viathe secure access channel 204 is significantly different from othersolutions and provides a comprehensive and secure environment forexchanging authentication credentials and interacting with downstreamweb sites 253.

In the described embodiments above, the initial web browser challenge415 can be sent unencrypted or unencrypted. In processing the userlook-up action, the data created or identified as a part of theabove-described process includes a User ID and an associated Session IDthat are created at that time (action 440). The User ID is looked upbefore its linking to a new Session ID, which is initially merely a newrecord in the session table in the session database 320.

The session database 320 may be kept unencrypted, but the User IDs usedfor each session are transmitted with encryption, and the User IDs arethus preserved encrypted in the back end of the secure system 200 toprotect them from disclosure on the general internet. The motivation toprovide this selected encryption is that it removes the incentive to tryto “crack” a particular database. Thus, even if a hacker were to “crack”one database, without the other cross-referenced database access, thehacker would not be able to tell what the “cracked” data relates to.Further, each user with each provider has a different encryption key,even further limiting the scope of what could be learned by “cracking” adatabase.

As a part of the launch session (action 460), the Session ID is sent tothe user's local browser 202 a, which then starts up the thin clientprocess 202 b. Referring back to FIG. 3, there is a handoff between theuser's local browser 202 a and the thin client process 202 b where moreformal authentication activities can occur. Thus, the original user'slocal browser 202 a authentication process only connects to the webauthentication server 205, which only accesses the user database 317 andthe session database 320, but nothing related to more formal userauthentication or account information.

The authenticated service machine 220 is operable to validate thesession ID sent to it by the thin client process 202 b. In thisinstance, the authenticated service machine 220 connects to the sessiondatabase 320 to verify the validity of the session ID received from thethin client process 202 b. The validity of the session ID is determinedby making an inquiry to session database 320 regarding whether thesession ID currently exists and is not expired. Once the session ID isvalidated at action 475, the authenticated service machine 220 creates asecure jail 214 and launches the interactive authentication process 210.In other words, the foregoing steps were all directed to identificationof the user—the transparent authorization process 208 identified in FIG.2—but the interactive authentication process 210 has not yet stronglyauthenticated the user to fully access the secure disposable browser orother secure web container 226.

FIGS. 5A-5C illustrate a user interface for interactive authentication210. This interactive authentication process comprises the userinteracting with the launched but not yet authenticated securedisposable browser 226 within the secure jail 214 contained within theauthenticated service machine 220. The secure disposable browser appearsas a standard web browser to the user, but rather than being softwareoperating on the user's local machine 202, it is an application that isrunning on the authenticated service machine 220 within a secure jail214 at the secure service environment 200.

The interactive authentication process 210 will be further describedbelow, but it could be comprised of any human interface presently knownor developed in the future for providing interaction between a computerand a human—visual webpage cues, keyboard or mouse input, audio cuesand/or voice recognition input and supplemented with delivery ofout-of-band data (e.g. via the user's mobile phone) to strengthen theauthentication of the end user. The interactive authentication process210 may be more or less involved depending on the confidence intervalplaced on the user's authenticity from the preceding transparentauthentication process 208.

The interactive authentication process 210 also makes the assumptionthat inputting authentication data directly into the user's localmachine 202 can lead to compromise. As a result, the interactiveauthentication process 210 only requires the user to input a randomlyassigned and constantly changing representation of their authenticationdata into the user's local machine 202. This reduces the possibilitythat stolen system input data has long-term value since it does notcorrespond to the user's actual authentication data. Various applicabletechniques that could be implemented within the context of the precedingfigures, including FIG. 5, are described below.

For the exemplary interactive authentication process of FIGS. 5A-5C,during initial registration to the service the user establishes asequence of at least three random icons from a library of icons. Thisselected sequence of icons represents the user's interactiveauthentication sequence from thereon. Whenever subsequentlyauthenticating to the secure service environment 200, the user will bepresented with the interactive authentication process 210 within thesecure disposable browser 226. In this process the user will be requiredto select (using a mouse click) the correct icons in the correctsequence from a randomly displayed subset of icons. The subset of iconsdisplayed and the relative positioning of the user's specific icons willchange randomly each time the interactive authentication process 210 isdelivered. The arrow in FIG. 5A points to the first one of thesequential random icons that can be selected by a user click, whereasthe arrows in FIGS. 5B and 5C point to the second and third selectedicons respectively. As can be seen from the figures, these chosen iconsare presented as authentication images 510 in the interactiveauthentication screen display 520. This method satisfies the “somethingyou know” criterion of multi-factor authentication since it requires theuser to recall specific knowledge to demonstrate authenticity.

Another type of interactive authentication process 210 would require theuser to establish an x-digit PIN during registration to the service.This represents the user's interactive authentication data from thereon.Whenever subsequently authenticating to the secure service environment200, the user will be presented with a 0-9 number line, with each numberbeing randomly assigned or mapped to a single or double set of letters.(E.g., O=k, 1=ef, 2=t, 3=xc etc.) The user then uses the keyboard toinput the letters corresponding to the digits of his or her PIN.Furthermore, each time user enters a letter(s), the random mapping ofnumbers to letters changes. In this way, the system input data is neverthe same and the user's PIN is never directly revealed. This methodsatisfies the “something you know” criterion of multi-factorauthentication since it requires the user to recall specific knowledgeto demonstrate authenticity.

Another type of interactive authentication 210 would be to usephone-call-based authentication. The purpose of phone-call basedauthentication is to associate or bind a purported user's authenticationsession to the secure service environment 200 with a phone known to beowned by that purported user, thereby increasing the confidence that thepurported user is legitimate before granting full access to the secureservice environment 200. At initiation of the service, users coulddesignate a set of phone numbers (cell, home, etc.) with the secureservice environment 200. An authenticating phone call could then happenat any time during the transparent authentication or interactiveauthentication processes 208, 210 based on environment variables and/oruser-defined policies. A recorded greeting played for the user could bemade in the user's voice to provide comfort on the authenticity of thecalling party. Answering this call and entering either a pre-definedkey, PIN or password would accordingly authenticate the user. Ifsuccessful, the user would then return to the web session where theauthentication process will proceed automatically. This method satisfiesthe “something you have” criterion of multi-factor authentication sinceit requires the user to have possession of an identifiable item todemonstrate authenticity (namely the phone).

The above two techniques may be used in isolation or together dependingon the situation and/or the confidence interval placed around thetransparent authentication process 208. Phone-call based authenticationmay also be conditionally added in the scenario where there is no other“something you have” factor present (like a certificate on the user'slocal machine 202). This would reflect the scenario where a registereduser is attempting to access the secure service environment 200 from anew or untrusted local machine.

As described in FIG. 3 regarding out-of-band communications 332,variants of phone-call based authentication techniques in the disclosedsystems and methods include: (a) delivery via text of a one-time code tothe mobile phone that the user is required to enter into theauthentication process 208, 210; (b) delivery via a phone call of aone-time code that a user is required to enter into the authenticationprocess 208, 210 (c) generation of a one-time code on the smartphone(using a dedicated application) that the user is required to enter intothe authentication process 208, 210; (c) using a dedicated applicationon the smartphone to store/access a unique “authentication grid”,comprised of random numbers arrayed by column and row and asking theuser to enter a random combination into the web session (e.g., BS, K1,C3=2, 5, 8). This grid can be static, or it can dynamically refreshbased on some algorithm.

Outside of the systems and methods described above, additional“something you know” mechanisms are disclosed in the embodiments herein.These additional “something you know” techniques include but are notlimited to other image-based methods including:

-   -   Asking users to select images from pre-selected categories from        among an array of other random pictures—example categories        include planes, flowers, and people.    -   Asking users to select pre-determined items/regions within an        image—examples are the rudder on sailboat, a third seagull from        the left in a flock, the right shoe on a man, etc.    -   Asking users to draw a predefined image using their mouse within        a N-box grid, which essentially operates like a digital        signature.    -   Asking users to pair pictures based on some pre-defined        association between specific picture or categories—examples are        couplings of beds<=>boats, planes<=>castles.

Another authentication technique that could be used includes gamingconcepts, specifically including using knowledge of how a user choosesto play a game as an authentication technique. As an illustrativeexample, it could be learned how a user moves a “Pac Man”-type characterthrough a course or how the user plays tic-tac-toe. The games themselvescould be representations of various well-known games, and they could bepresented as represented in FIG. 5 as images or protocols 510 on thescreen 520.

Another authentication technique that could be used at this stageincludes capturing user gestures using various input devices. An examplewould be moving an accelerometer enabled device in x/y/z space and usingthe accelerometer to capture the motion, or using the finger/stylus toinput a gesture in x/y space on the screen.

Other authentication techniques that could be used at this stage includeword games and numerical puzzles. Users could complete pre-selectedphrases as an authentication technique, and this would include theability to craft user-specific shared secrets, phrases/quotes. Thesecure service environment 200 would supply half of the shared secretand the user would complete it. For numerical puzzles, users could beasked to complete simple pre-defined numerical equations as anauthentication technique. Users select or define an equation with thesecure service environment 200. The pre-defined equation could containstatic and dynamic parameters as well as random inputs, and the usercould control the complexity of the equation. A simple exemplaryequation would be “(Today's date)×(service provided random #)×(my age)”.

The disclosed embodiments include the collation and selective use of theabove techniques based on situational context and user preference,including based on an original confidence interval determined from thetransparent authentication process 208 as well as enabling usercustomization of large parts of the process.

As to the user customization of this process, in the disclosed systemsusers are enabled to customize their choice of interactiveauthentication process 210 as described above, as well as to customizethe situations and rules around when and how these methods are used.Following are exemplary customization methods. Users can select a“something you know” scheme from the list of many provided as well asconditionally complement it with a “something you have” scheme. Userscan determine the specific elements of their selected scheme (pictures,equation, PIN, gesture, phrase, call, SMS etc). Users can create defaultor conditional rules for when different parts of the interactiveauthentication process 210 is used—examples include—“Always call myphone to authenticate me”; “Send me an SMS when you're unsure of myauthenticity”; “Perform out-of-band authentication whenever I'm comingfrom a new machine, a new location or out of my normal hours”; “Alwaysprompt me for authentication whenever I access www.mybank.com” etc.

Thus far the above schemes for transparent and interactiveauthentication processes 208, 210 have described methods to authenticatethe user attempting to access the secure service environment 200.Described below are methods for the secure service environment 200 toconvey its authenticity to an end user. Such methods rely on the notionthat certain information about the user and the user's behavior isuniquely known by the secure service environment 200. Displaying thisdata to the user allows a legitimate user to have greater confidencearound the authenticity of the secure service environment 200 whilecorrespondingly increasing the difficulty for a fraudulent service todeceive the user. Examples of such data includes display of user'snickname, history of logins, map of recent login locations, accuratedownstream website 253 accounts, browsing history and bookmarks etc. Theuser can use any or all combinations of these elements to validate theauthenticity of the secure service environment 200.

FIG. 6 provides the user screen for the authenticated secure disposablebrowser 226 within the secure jail 214 contained within theauthenticated service machine 220. This screen is provided once the userhas successfully undergone transparent and interactive authenticationprocesses 208, 210, and it shows a user's established accounts. For theestablished accounts shown here on this screen, the secure serviceenvironment 200 has captured and stored user credentials at the user'sconsent, such that a user can automatically login with one-click to hisor her established accounts from any local machine 202 from which theuser has accessed the secure service environment 200. The user screenalso provides multiple browsing tabs as can be seen at the top, whereeach tab can present images representing a different downstream website253 or web page. As previously mentioned, the user's local machine doesnot receive and process web code as all web code is instead processedwithin the secure disposable browser or other secure web container 226.The user's local machine 202 is accordingly dislocated from malware orother internet exploits since it is not directly exposed to the publicinternet. The service provider is also protected in this as it is notdirectly exposed to potentially compromised user client machines.

FIGS. 7-8 provide additional screen shots that illustrate a user's loginhistory in terms of login date, identifying name of local machine,duration of the session with the secure service environment 200, trustedor untrusted nature of the user's local machine and current activesession versus previously active sessions. As demonstrated here, theuser can access the secure service environment 200 from anyinternet-accessible machine. Moreover, the user can then also optionallychoose to trust, untrust or delete certain machines that they have usedto access the secure service environment 200. The consequence oftrusting or untrusting a machine determines the incremental steps andsequencing required during the transparent and interactiveauthentication processes 208, 210 when accessing the secure serviceenvironment 200. For example, when accessing the service from anuntrusted, deleted or previously never used machine, the secure serviceenvironment 200 will perform out-of-band authentication during thetransparent authentication process 208, and also prompt for theinteractive authentication process 210 immediately upon accessing thesecure disposable browser or other secure web container 226. Incontrast, when accessing the secure service environment 200 from atrusted machine, the user may bypass out-of-band authenticationaltogether and only be required to perform interactive authentication210 within the secure disposable browser or other secure web container226 when attempting to access or modify user data.

Description of Specific API Web Container Environment

FIG. 9 illustrates a secure web container service environment embodimentof the secure service environment 200 of FIG. 2. In general, the secureweb container service environment embodiment discloses a “push” model,as opposed to a “pull” model where a user initiates the service. In thisembodiment, a website owner asks the secure service environment 200 tocontain its content in the secure browser and deliver it to the user viathe disclosed “push” model using API calls 284. When a user clicks on alink or accesses a webpage via his or her local browser 202 a, thewebsite owner passes an API call 284 to the secure service environment200. The secure service environment 200 instantiates the browserrendering framework, populates it with page data (or empty), and pushesthe display to the user. From the user's perspective, the user seesanother window or a tab, and does not go through any other connectionprocess.

The secure service environment 200 may include various machines,servers, and processes as discussed above in relation to FIG. 2. Thus,the secure service environment 200 may include, for example, webauthentication server 205, data translation server 206, transparentauthentication process 208, interactive authentication process 210,secure user data store 212, secure jail 214, authenticated servicemachine 220, web analysis server 250, downstream web server analysisprocess 252, admin policy portal 260, and policy database 262. Thesecure service environment 200 may also include an applicationprogramming interface (“API”) layer 286 in communication with arequesting party server 282 and further in communication with an APIserver 288. The API server 288 is in communication with theauthenticated service machine 220 and policy database 262. The secureservice environment 200 may also include a secure web container 226within a per-user secure jail 214 in the authenticated service machine220. The policy database memory 262 may include a plurality of policieswhich may be used with a plurality of requesting party applicationproviders based on the syntax of the APL.

The API server 288 is operable to validate an API call 284 received froma requesting party application 280 of a requesting party applicationprovider. Requesting party applications 280 are on a requesting partyserver 282 which operates remotely from the user's local machine 202.Depending on the situation, the requesting party server 282 may operateremotely or locally with respect to the secure service environment 200.For example, in an embodiment, the requesting party server 282 is aremote server in communication with the service environment 200. Inanother embodiment, the requesting party server 282 is a local serverconnected via a local network (e.g., LAN, WAN, etc.) with the secureservice environment 200.

Requesting party applications 280 may comprise online services. Therequesting party server 282 is in communication with the user's localmachine 202 and the API layer 286 in the secure service environment 200.Upon validation of the API call 284, a secure web container 226 isconstructed within the secure service environment 200, which is operatedsecurely and remotely from the user's (potentially compromised) localmachine 202. Thus, the secure web container 226 is invoked to effectdisplaying images representative of requesting party application webcontent at the user's local machine 220 based on the API call 282. Theimages representative of the requesting party application web content istranslated using a network and application protocol and delivered (viadata translation server 206) to the end user's local machine 202 asencrypted data over a secure access channel 204. The thin client process202 b on the end user's local machine 202 decrypts and renders this datato the user as an image of the secure web container running within thesecure service environment 200.

The secure web container 226 may be invoked based on the triggering ofone or more triggers defined within the requesting party application280. The triggers may automatically cause the requesting partyapplication to make an API call 284 to the API layer 286 of the secureservice environment 200. It should be appreciated that the requestingparty can invoke requests from contexts other than online services orwebsites. It could be any application or service that would call the APIto deliver secure web content, such as a local email application, a usersupport or ticketing system, or any of a number of other applicationsthat might invoke a need for secure user interaction.

To invoke the secure web container 226 based on the API call 284, an APIserver 288 is in communication with the API layer 286, the policydatabase 262, and the authenticated service machine 220. The API server288 validates and processes the API call 284. In some embodiments, theAPI server 288 instructs the authenticated service machine 220 toconstruct a generic secure web container. In other embodiments, the APIserver 288 instructs the authenticated service machine 220 to constructa secure web container based on policy records in the requesting partyapplication data store and/or policies in the policy database 262. In anembodiment, the API server 288 may determine which policy is associatedwith which requesting party application via looking up the requestingparty's policy record(s) in the policy database 262. The server mayfurther instruct the authenticated service machine 220 to invoke thesecure web container 226 based on the policy record(s) determined fromthe policy database 262. To effect the invocation, the API server 288determines which policy or policies from the policy database 262 areassociated with the requesting party's policy record(s) and instructsthe authenticated service machine 220 to use relevant policies for thesecure web container 226. The authenticated service machine 220 is incommunication with the policy database 262 and may retrieve the relevantpolicy or policies from the policy database 262 when invoking the secureweb container 226.

The secure web container 226 may be a disposable web browser. Thedisposable web browser may be provided to display within an existingbrowser window at the user's local machine 202 as an additional tab ofthe existing browser window at the user's local machine 202, as asub-window associated with the existing browser at the user's localmachine 202, or as a separate system window at the user's local machine202.

Still referring to FIG. 9, a policy record associated with therequesting party application 280 may be determined at the API server288. In this embodiment, the requesting party application data store 290in communication with the API server 288 and the policy database 262effect determining the policy record associated with the requestingparty application 280. The policy record may also be received from therequesting party application 280 substantially simultaneously with theAPI call 284. Thus, the API call 284 may define a policy or a policyrecord in several ways. The requesting party application data store 290may also include policy attributes which govern aspects ofuser-interaction with the web content. One or more of the policyattributes may be associated with one or more of the plurality of policyrecords in the policy database 262. Policy attributes may also bereceived from the requesting party application 280 simultaneously withthe API call 284. Thus, the API call 284 may also define policyattributes in several ways.

To allow administrators to set policies for a plurality of requestingparty application providers, a policy portal server may be connected tothe policy database memory 262. An administrator may be one of theplurality of requesting party application providers, which would enablethe administrator the provide its own policy record. Additionally, anadministrator may set policy records on behalf of the plurality ofrequesting party application providers.

Illustrated in FIG. 10 is a functional-level view of the secure serviceenvironment 200 of FIG. 9. This figure illustrates the interactionbetween some of the system elements described in FIG. 9. While there arecertain elements shown in FIG. 9 that are not illustrated in FIG. 10 andvice versa, one of ordinary skill in the art would be able toadvantageously describe with respect to one figure in order to achievethe advantages described herein for operation with the embodiment shownin other figures. All such embodiments are understood by one of ordinaryskill in the art to be encompassed within the present specification.

The disposable web container API allows any web service or otherapplication (defined as the requesting party) to programmatically invokea secure web container for displaying web content. The requesting partywill develop against the API to integrate triggers into theirapplication that spawns the disposable browser. These triggers can bedefined by the requesting party and contained within their applicationlogic. The API exposes a basic syntax for making a call to thedisposable web container service when a trigger has been invoked. Thedisplay of the content and the controls in place to govern userinteraction with the content or ability to access third party webcontent using the disposable browser can be pre-defined and storedwithin the disposable web container service or delivered as party of thesyntax of invoking the disposable browser. Users may have no priorknowledge of these triggers, and can be seamlessly transitioned to thedisposable browser at the point of invocation.

Referring to FIG. 10, user interacts on local machine 202 a nativelywith requesting party application 280 (via the local browser, if a webservice). User invokes a trigger within the application that makes anAPI call 284 to the secure web container 226 service. Secure webcontainer 226 validates the requesting API call 284 and interprets APIsyntax, which may include site URL to publish and browser attributes(such as navigation elements to include or suppress, duration ofsession, and more). Secure web container 226 prepares the policy recordassociated with the requesting party 280 API call 284 that will governthe user interaction with the disposable browser. This policy record maybe included as part of the requesting API call 284 or may be storedwithin secure web container 226 and fetched at invocation from a securepolicy database or policy profile 262. The secure web container 226 isbuilt in a sandbox with specified policy attributes invoked. Policyattributes govern any and all aspects of the user interaction with thecontent within the secure web container 226, including file up/downloadcapability, external linking/navigation, presence of free-form browsernavigation elements and menus, copy/paste capability, session durationand/or termination rules and more. The user is prompted todownload/accept remote agent 202 b (if necessary or if absent), afterwhich user is presented with the secure web container 226 disposablebrowser from within their existing browser window, as an additional tabwithin their browser, as a sub-window associated with their browser, asa separate system window, or other. User continues within disposablebrowser for the remainder of the session, as defined by policy controls.Requesting party 280 updates local browser window with reference to thesecure web container 226 disposable browser window or tab. When thesession is complete, either via user action or secure web container 226action, all user browsing data is purged.

FIG. 11 is a flow chart illustrating a method for providing userinteraction with requesting party applications in the secure webcontainer service environment 200 described in FIG. 9. The API layer inthe secure service environment 200 receives an API call from therequesting party application at action 1151. The API call is validatedat action 1153. The policy record(s) associated with the requestingparty application are determined at action 1155. As discussed above inrelation to FIG. 9, the policy record(s) associated with the requestingparty application may be retrieved from the policy database 262. The APIlayer invokes a secure web container for displaying imagesrepresentative of the requesting party application web content at theuser's local machine based on the API call at action 1157.

FIGS. 12A-12C are schematic diagrams illustrating various embodiments ofthe secure web container. FIG. 12A shows an embodiment in which a firstembodiment of the secure web container 1200 is provided to displaywithin an existing browser window at the user's local machine as asub-window associated with the existing browser window at the user'slocal machine. FIG. 12B shows an embodiment in which a second embodimentof the secure web container 1210 is provided to display within anexisting browser window at the user's local machine as an additional tabof the existing browser window at the user's local machine. FIG. 12Cshows an embodiment in which a third embodiment 1220 of the secure webcontainer is provided to display within an existing browser window atthe user's local machine as a separate system window at the user's localmachine.

While various embodiments have been described above, it should beunderstood that they have been presented by way of example only, and notlimitation. Thus, the breadth and scope of a preferred embodiment shouldnot be limited by any of the above described exemplary embodiments, butshould be defined only in accordance with the claims and theirequivalents for any patent that issues claiming priority from thepresent provisional patent application. Further, there are a number ofembodiments for authentication and other features that are described inthe context of a “pull” type disposable browser environment, but itshould be appreciated that such embodiments are further applicable toAPI-type “push” embodiments as well according to design needs. Althoughthere are references in particular embodiments to “secure disposablebrowsers,” “secure web containers” and “secure web renderingframeworks,” it should be appreciated that depending upon context theseterms may be used interchangeably to refer to the presentation of webimages to a user in a secure embodiment, and the terminology is used indifferent contexts according to the end use that is being described atthe time. In general, and according to design needs, the describedembodiments may all be used in the other end uses or contexts. It shouldfurther be appreciated that “API” as used herein refers to any type ofcoordination between operating instances in different systemscommunicating with each other. The term “API” is not intended to belimited solely to specific application programming interface calls atthe software level.

For example, as referred to herein, a machine or engine may be a virtualmachine, computer, node, instance, host, or machine in a networkedcomputing environment. Also as referred to herein, a networked computingenvironment is a collection of machines connected by communicationchannels that facilitate communications between machines and allow formachines to share resources. Network may also refer to a communicationmedium between processes on the same machine. Also as referred toherein, a server is a machine deployed to execute a program operating asa socket listener and may include software instances.

Resources may encompass any types of resources for running instancesincluding hardware (such as servers, clients, mainframe computers,networks, network storage, data sources, memory, central processing unittime, scientific instruments, and other computing devices), as well assoftware, software licenses, available network services, and othernon-hardware resources, or a combination thereof.

A networked computing environment may include, but is not limited to,computing grid systems, distributed computing environments, cloudcomputing environment, etc. Such networked computing environmentsinclude hardware and software infrastructures configured to form avirtual organization comprised of multiple resources which may be ingeographically disperse locations. Although various computer elementshave been illustrated herein as single computer servers or machines,such elements may operate over several different physical machines, orthey may be combined as operating code instances running on a singlephysical machine. The claims in the present application comprehend suchvariation in physical machine configurations.

Various computer elements have been illustrated herein as singlecomputer servers or machines, such elements may operate over severaldifferent physical machines, or they may be combined as operating codeinstances running on a single physical machine. The claims in thepresent application comprehend such variation in physical machineconfigurations.

Various terms used herein have special meanings within the presenttechnical field. Whether a particular term should be construed as such a“term of art,” depends on the context in which that term is used.“Connected to,” “in communication with,” or other similar terms shouldgenerally be construed broadly to include situations both wherecommunications and connections are direct between referenced elements orthrough one or more intermediaries between the referenced elements,including through the Internet or some other communicating network.“Network,” “system,” “environment,” and other similar terms generallyrefer to networked computing systems that embody one or more aspects ofthe present disclosure. These and other terms are to be construed inlight of the context in which they are used in the present disclosureand as those terms would be understood by one of ordinary skill in theart would understand those terms in the disclosed context. The abovedefinitions are not exclusive of other meanings that might be impartedto those terms based on the disclosed context.

Words of comparison, measurement, and timing such as “at the time,”“equivalent,” “during,” “complete,” and the like should be understood tomean “substantially at the time,” “substantially equivalent,”“substantially during,” “substantially complete,” etc., where“substantially” means that such comparisons, measurements, and timingsare practicable to accomplish the implicitly or expressly stated desiredresult.

Additionally, the section headings herein are provided for consistencywith the suggestions under 37 CFR 1.77 or otherwise to provideorganizational cues. These headings shall not limit or characterize theinvention(s) set out in any claims that may issue from this disclosure.Specifically and by way of example, although the headings refer to a“Technical Field,” such claims should not be limited by the languagechosen under this heading to describe the so-called technical field.Further, a description of a technology in the “Background” is not to beconstrued as an admission that technology is prior art to anyinvention(s) in this disclosure. Neither is the “Brief Summary” to beconsidered as a characterization of the invention(s) set forth in issuedclaims. Furthermore, any reference in this disclosure to “invention” inthe singular should not be used to argue that there is only a singlepoint of novelty in this disclosure. Multiple inventions may be setforth according to the limitations of the multiple claims issuing fromthis disclosure, and such claims accordingly define the invention(s),and their equivalents, that are protected thereby. In all instances, thescope of such claims shall be considered on their own merits in light ofthis disclosure, but should not be constrained by the headings set forthherein.

What is claimed is:
 1. A secure system for providing a secure onlineenvironment for interacting with downstream sites using web-basedapplications, the system comprising: a client device interfacecomprising a secure channel operable to communicate with a user clientdevice through an image protocol, wherein commands from a downstreamsite are not passed from the downstream site to the user client device;a policy database operable to store policies for user access to andinteraction with the downstream site, the policy database comprisingpolicy information; a policy portal in communication with the policydatabase, the policy portal operable to provide access to anadministrator for configuring the policies for user access to andinteraction with the downstream site; an authenticated service device incommunication with the client device interface and the policy database,wherein the authenticated service device is operable to access andinteract with the downstream site at the user client device and theauthenticated service device further comprises a secure environment anda secure web container within the secure environment; and a secure datastore in communication with the authenticated service device, the securedata store operable to store user credentials for accessing andinteracting with the downstream site in accordance with the policiesstored in the policy database, wherein the authenticated service deviceis operable to authenticate to the downstream site based on the usercredentials, and provide, using the image protocol and via the clientdevice interface, content associated with the downstream site to theuser client device, and wherein the user credentials are not transmitteddirectly from the user client device to the downstream site.
 2. Thesystem of claim 1, wherein the policy database further comprisespolicies stored within the policy database that allow for behavioralrules to define user access to and interaction with the downstream site.3. The system of claim 1, wherein the user credentials are fetched fromwithin the secure environment, such that automatic downstream sitelogins are provided without transmitting the user credentials to theuser client device.
 4. The system of claim 1, further comprisingcreating a session ID, wherein the session ID is assigned in a sessiondatabase and wherein the session ID is associated with the user.
 5. Thesystem of claim 4, wherein the session database validates the sessionID, wherein, based on the validation of the session ID, a session islaunched, wherein the session connects to the secure environment.
 6. Thesystem of claim 5, wherein the session is rendered by a thin clientprocess.
 7. The system of claim 6, further comprising a data translationserver, wherein the thin client process decrypts and renders datareceived by the data translation server.
 8. The system of claim 1,further comprising disposing the secure web container within the secureenvironment thereby protecting user data from unauthorized access. 9.The system of claim 2, wherein the policies further comprise firstbehavioral rules that are defined and applied as global policies. 10.The system of claim 3, wherein the policies further comprise secondbehavioral rules that are defined and applied on a per-downstreamwebsite basis, such that the policies comprising the second behavioralrules are specific to at least one of the following: a particularwebsite account and a destination site.
 11. A method for providing asecure online environment for interacting with downstream sites usingweb-based applications, the method comprising the steps of: providing aclient device interface comprising a secure channel operable tocommunicate with a user client device through an image protocol, whereincommands from a downstream site are not passed from the downstream siteto the user client device; providing a policy database operable to storepolicies for user access to and interaction with the downstream site,the policy database comprising policy information; providing a policyportal in communication with the policy database, the policy portaloperable to provide access to an administrator for configuring thepolicies for user access to and interaction with the downstream site;providing an authenticated service device in communication with theclient device interface and the policy database, wherein theauthenticated service device is operable to access and interact with thedownstream site at the user client device and the authenticated servicedevice further comprises a secure environment and a secure web containerwithin the secure environment; and providing a secure data store incommunication with the authenticated service device, the secure datastore operable to store user credentials for accessing and interactingwith the downstream site in accordance with the policies stored in thepolicy database, wherein the authenticated service device is operable toauthenticate to the downstream site based on the user credentials, andprovide, using the image protocol and via the client device interface,content associated with the downstream site to the user client device.12. The method of claim 11, wherein the policy database furthercomprises policies stored within the policy database that allow forbehavioral rules to define user access to and interaction with thedownstream site.
 13. The method of claim 11, wherein the usercredentials are fetched from within the secure environment, such thatautomatic downstream site logins are provided without transmitting theuser credentials to the user client device.
 14. The method of claim 11,further comprising creating a session ID, wherein the session ID isassigned in a session database and wherein the session ID is associatedwith a user.
 15. The method of claim 14, wherein the session databasevalidates the session ID, wherein, based on the validation of thesession ID, a session is launched, wherein the session connects to thesecure environment.
 16. The method of claim 15, wherein the session isrendered by a thin client process.
 17. The method of claim 16, furthercomprising a data translation server, wherein the thin client processdecrypts and renders data received by the data translation server. 18.The method of claim 11, further comprising disposing the secure webcontainer within the secure environment thereby protecting user datafrom unauthorized access.
 19. The method of claim 12, wherein thepolicies further comprise first behavioral rules that are defined andapplied as global policies.
 20. The method of claim 13, wherein thepolicies further comprise second behavioral rules that are defined andapplied on a per-downstream website basis, such that the policiescomprising the second behavioral rules are specific to a particularwebsite account or a destination site.